Skip to main content

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

© 2026 Mondoo, Inc.

Privacy Policy Terms of Service Imprint

Vulnerability Intelligence

Vulnerability IntelligenceCVE-2016-10161

CVE-2016-10161

HIGH7.5

The object_common1 function in ext/standard/var_unserializer

Published Jan 24, 2017

Modified 1 years ago

Details

The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.

References

http://php.net/ChangeLog-5.php

http://php.net/ChangeLog-7.php

http://www.debian.org/security/2017/dsa-3783

http://www.securityfocus.com/bid/95768

http://www.securitytracker.com/id/1037659

https://access.redhat.com/errata/RHSA-2018:1296

https://bugs.php.net/bug.php?id=73825

https://github.com/php/php-src/commit/16b3003ffc6393e250f069aa28a78dc5a2c064b2

https://security.gentoo.org/glsa/201702-29

https://security.netapp.com/advisory/ntap-20180112-0001/

https://www.cve.org/CVERecord?id=CVE-2016-10161

https://www.tenable.com/security/tns-2017-04

CVSS Analysis

CVSS v3.0

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ecosystems

Timeline

PublishedJan 24, 2017

ModifiedAug 6, 2024

CVE-2016-10161 | Mondoo Vulnerability Intelligence